Skip to content
NewA calmer, faster ZeroHour
Vulnerabilitylow

Apache James SSRF filter bypass in JMAP web-push client

Original title: CVE-2026-76171: Apache James: SSRF filter bypass in the JMAP PushSubscription web-push client

oss-security ()
Read at seclists.org
Part of a story covered by 2 sourcesApache James JMAP Issues: ACL Bypass and SSRF Bypass ReportedMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

Apache James server allows bypass of the SSRF filter in its JMAP PushSubscription web-push client.

The vulnerability exists in the JMAP PushSubscription web-push client of Apache James. It was posted on oss-security with low severity.

Key facts
  • Low severity CVE
  • Affects Apache James JMAP web-push client
Analyze CVE-2026-76171 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-76171
Tags
apachejames
Vendors
Apache
Products
James

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-76171
SSRF bypass in Apache James JMAP webPush before 3.9.1
9.1—

From the original article

Posted by Benoit Tellier on Nov 06 Severity: low https://james. apache. org/ https://www.

oss-security

seclists.org

Read the full article at oss-security

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.